From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Wed, 18 Jan 2012 00:06:51 +0000 (-0800)
Subject: Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit
X-Git-Tag: v3.3-rc1~23
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=f429ee3b808118591d1f3cdf3c0d0793911a5677;p=uclinux-h8%2Flinux.git

Merge branch 'for-linus' of git://git./linux/kernel/git/viro/audit

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit: (29 commits)
  audit: no leading space in audit_log_d_path prefix
  audit: treat s_id as an untrusted string
  audit: fix signedness bug in audit_log_execve_info()
  audit: comparison on interprocess fields
  audit: implement all object interfield comparisons
  audit: allow interfield comparison between gid and ogid
  audit: complex interfield comparison helper
  audit: allow interfield comparison in audit rules
  Kernel: Audit Support For The ARM Platform
  audit: do not call audit_getname on error
  audit: only allow tasks to set their loginuid if it is -1
  audit: remove task argument to audit_set_loginuid
  audit: allow audit matching on inode gid
  audit: allow matching on obj_uid
  audit: remove audit_finish_fork as it can't be called
  audit: reject entry,always rules
  audit: inline audit_free to simplify the look of generic code
  audit: drop audit_set_macxattr as it doesn't do anything
  audit: inline checks for not needing to collect aux records
  audit: drop some potentially inadvisable likely notations
  ...

Use evil merge to fix up grammar mistakes in Kconfig file.

Bad speling and horrible grammar (and copious swearing) is to be
expected, but let's keep it to commit messages and comments, rather than
expose it to users in config help texts or printouts.
---

f429ee3b808118591d1f3cdf3c0d0793911a5677
diff --cc init/Kconfig
index 6ac2236244c3,fe25ffbe818b..3f42cd66f0f8
--- a/init/Kconfig
+++ b/init/Kconfig
@@@ -372,6 -372,20 +372,20 @@@ config AUDIT_TRE
  	depends on AUDITSYSCALL
  	select FSNOTIFY
  
+ config AUDIT_LOGINUID_IMMUTABLE
+ 	bool "Make audit loginuid immutable"
+ 	depends on AUDIT
+ 	help
 -	  The config option toggles if a task setting it's loginuid requires
++	  The config option toggles if a task setting its loginuid requires
+ 	  CAP_SYS_AUDITCONTROL or if that task should require no special permissions
+ 	  but should instead only allow setting its loginuid if it was never
+ 	  previously set.  On systems which use systemd or a similar central
+ 	  process to restart login services this should be set to true.  On older
+ 	  systems in which an admin would typically have to directly stop and
+ 	  start processes this should be set to false.  Setting this to true allows
+ 	  one to drop potentially dangerous capabilites from the login tasks,
+ 	  but may not be backwards compatible with older init systems.
+ 
  source "kernel/irq/Kconfig"
  
  menu "RCU Subsystem"